Seven size matches point to possible packaged PE counterparts
Seven ZLIB-containing objects report expanded sizes matching separately listed Windows executables and DLLs, making them candidate packaged forms rather than confirmed identical files. A separate sandbox report shows a process writing temporary files and confirms that two files at different paths share a hash.
A compressed object submitted as launch.exe is reported to expand to 176,386 bytes—the exact size of a separately listed Windows executable, ntmstart.exe. The same pattern recurs across six other compressed records and their possible executable or DLL counterparts. Are these additional components, or different representations of the same underlying files?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read